We are making an app that only reads data from Health Kit. Even though we only read, when we push the app to TestFlight, we get an email saying its missing the NSHealthUpdateUsageDescription key. We only provided the NSHealthShareUsageDescription key as we are only reading data. So we are now forced to provide the NSHealthUpdateUsageDescription key with same text as the NSHealthShareUsageDescription even though it will never be used.
Further, when we delete the app, iOS shows an alert asking the user if they want to delete Health Kit data when they try to delete the app.
Why do we get the alert and why do we need to provide the NSHealthUpdateUsageDescription when we are only reading data from Health Kit?
According to the official NSHealthUpdateUsageDescription documentation:
To protect user privacy, an iOS app linked on or after iOS 10.0, and that reads the user’s health data, must statically declare the intent to do so. Include the NSHealthUpdateUsageDescription key in your app’s Info.plist file and provide a purpose string for this key.
Even though you're not really writing or changing HealthKit data, you're still accessing it. And in some regions (such as the USA, and I suspect even more strongly within the EU), health privacy is considered a relatively important & legally required thing. So your app's users have to officially acknowledge and permit your app to read HealthKit data.
As for why you're seeing an alert about data potentially being removed, I suspect there is a tiny bit of data written by the HealthKit API's (e.g. to mark that your app is allowed to read the data, or perhaps some logging of what data is read)